Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Scanners

Confirm MongoDB hosts leak via OP_COMPRESSED

CVE-2025-14847 MongoDB memory disclosure scanner.

Agent
Test exposed MongoDB hosts for the bleedTriage a large estate fastConfirm findings with leaked samples

overview

What mongobleed does

mongobleed tests MongoDB listeners for CVE-2025-14847. It sends crafted OP_COMPRESSED packets, watches for leaked memory in the response, and flags hosts that bleed data. The check follows Joe Desimone's published exploit technique.

Feed --input a file of hosts in host, host:port, http(s), or mongodb URI form. Raise --concurrency for wide estates. --quiet prints only vulnerable hits; --verbose adds leaked-memory samples so you can confirm a finding before you escalate.

Place it after port discovery so only confirmed MongoDB listeners are tested. Prefer mongobleed for this single flaw; use nuclei when you need a multi-CVE template pack on the same host list.

use cases

Where mongobleed fits

Test exposed MongoDB hosts for the bleed

Run mongobleed against hosts found listening on MongoDB ports to confirm which ones leak memory through the OP_COMPRESSED flaw.

Triage a large estate fast

Raise --concurrency to scan hundreds of hosts at once and use --quiet so the output lists only the vulnerable targets that need action.

Confirm findings with leaked samples

Enable --verbose to print samples of the disclosed memory, turning a yes/no result into evidence you can include in a report.

Chain after a port scan

Feed mongobleed the MongoDB hosts from naabu or masscan so the vulnerability check only touches services already confirmed open.

reference

mongobleed inputs and flags

9 inputs
NameTypeFlagDescription
inputFILE--inputFile of targets, one per line; supports host, host:port, http(s)://host:port, and mongodb://host:port.
concurrencySTRING--concurrencyNumber of concurrent connections (default 200).
timeoutSTRING--timeoutConnection timeout in seconds (default 5).
quietBOOLEAN--quietQuiet mode, show only vulnerable hosts.
verboseBOOLEAN--verboseVerbose output with leaked data samples.
doc-lenSTRING--doc-lenBSON document length for the exploit (default 100).
buffer-sizeSTRING--buffer-sizeInflated buffer size to trigger the leak (default 600).
all-resultsBOOLEAN--all-resultsInclude all results in output, not only vulnerable hosts.

Showing key inputs. mongobleed exposes 9 inputs in total.

Full flag reference (9 inputs)
NameTypeFlagDescription
inputFILE--inputFile containing targets (one per line, supports: host, host:port, http://host:port, https://host:port, mongodb://host:port)
quietBOOLEAN--quietQuiet mode (only show vulnerable hosts)
doc-lenSTRING--doc-lenBSON document length for exploit (default 100)
timeoutSTRING--timeoutConnection timeout in seconds (default 5)
verboseBOOLEAN--verboseEnable verbose output with leaked data samples
no-colorBOOLEAN--no-colorDisable colored output
all-resultsBOOLEAN--all-resultsInclude all results in output (not only vulnerable)
buffer-sizeSTRING--buffer-sizeInflated buffer size to trigger leak (default 600)
concurrencySTRING--concurrencyNumber of concurrent connections (default 200)

example

Run mongobleed

mongobleed · command
# quiet scan of MongoDB targets for CVE-2025-14847mongobleed --input mongo-hosts.txt --quiet --concurrency 200 --timeout 5
sample output
198.51.100.10:27017 VULNERABLE203.0.113.25:27017 VULNERABLE192.0.2.40:27017 not vulnerablemongo.dev.example.com:27017 VULNERABLEdb.staging.example.com:27017 not vulnerable198.51.100.88:27017 VULNERABLEapi.example.com:27017 not vulnerable

guidance

Choosing mongobleed

Reach for mongobleed when you already have MongoDB hosts and need a CVE-2025-14847 yes or no. It is not a discovery scanner. Feed a target list from a port scan, then use --quiet to surface only hosts that leak.

nuclei

Template-driven scanner covering many CVEs. mongobleed stays purpose-built for this one OP_COMPRESSED memory disclosure check.

naabu

Port scanner that finds MongoDB listeners to feed mongobleed. Run them in sequence, not as substitutes.

mongobleed-loop

Same check wrapped for larger target sets when you need batch orchestration around the core scanner.

workflows

Workflows using mongobleed

1 workflow

  1. Find Exposed Databases

    Port-scan a range for eight database engines and check every open service for unauthenticated access, from MongoDB and Redis to PostgreSQL.

faq

mongobleed questions

CVE-2025-14847, a MongoDB memory disclosure reached through malformed OP_COMPRESSED packets. Hosts that return leaked memory are marked vulnerable.

related

More Scanners tools

  1. ac-scanner

    BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.

  2. airixss

    Reflection triage for parameter URLs during recon.

  3. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  4. cmseek

    CMS detection and version fingerprinting.

  5. jaeles

    Signature-driven web application scanner.

  6. joomscan

    OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.

Run mongobleed yourself

A host list feeds naabu to find open MongoDB ports, then mongobleed tests those hosts for CVE-2025-14847 and writes the vulnerable ones as a queryable output.

Open mongobleed in the libraryView the workflow

Facts on this page come from the live Trickest tool library.